WinRAR for Windows path traversal via NTFS Alternate Data Streams

# check-winrar-cve-2025-8088.ps1

# Detects likely exposure to CVE-2025-8088 on Windows hosts.

# Checks WinRAR.exe / rar.exe / UnRAR.dll versions where commonly installed.

# Output: VULNERABLE / PATCHED / UNKNOWN

# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN


$ErrorActionPreference = 'SilentlyContinue'
$patchedVersion = [version]'7.13.0.0'
$found = @()

function Add-FoundFile {
    param(
        [string]$Path
    )
    if (Test-Path -LiteralPath $Path) {
        try {
            $item = Get-Item -LiteralPath $Path
            $verString = $item.VersionInfo.FileVersion
            if (-not [string]::IsNullOrWhiteSpace($verString)) {
                $clean = ($verString -replace '[^0-9\.]', '')
                $ver = [version]$clean
                $script:found += [pscustomobject]@{
                    Path = $Path
                    Version = $ver
                    RawVersion = $verString
                }
            }
        } catch {
        }
    }
}

# Common install paths

$paths = @(
    "$env:ProgramFiles\WinRAR\WinRAR.exe",
    "$env:ProgramFiles\WinRAR\Rar.exe",
    "$env:ProgramFiles\WinRAR\UnRAR.dll",
    "$env:ProgramFiles(x86)\WinRAR\WinRAR.exe",
    "$env:ProgramFiles(x86)\WinRAR\Rar.exe",
    "$env:ProgramFiles(x86)\WinRAR\UnRAR.dll"
)

foreach ($p in $paths) { Add-FoundFile -Path $p }

# Registry uninstall keys

$uninstallRoots = @(
    'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*',
    'HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*',
    'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*'
)

foreach ($root in $uninstallRoots) {
    try {
        Get-ItemProperty $root | Where-Object {
            $_.DisplayName -match 'WinRAR'
        } | ForEach-Object {
            if ($_.InstallLocation) {
                Add-FoundFile -Path (Join-Path $_.InstallLocation 'WinRAR.exe')
                Add-FoundFile -Path (Join-Path $_.InstallLocation 'Rar.exe')
                Add-FoundFile -Path (Join-Path $_.InstallLocation 'UnRAR.dll')
            }
        }
    } catch {
    }
}

# Deduplicate by path

$found = $found | Sort-Object Path -Unique

if (-not $found -or $found.Count -eq 0) {
    Write-Output 'UNKNOWN: WinRAR/UnRAR components not found in common locations.'
    Write-Output 'UNKNOWN'
    exit 2
}

$vuln = $false
foreach ($f in $found) {
    Write-Output ("Found: {0} | Version: {1}" -f $f.Path, $f.RawVersion)
    if ($f.Version -lt $patchedVersion) {
        $vuln = $true
    }
}

if ($vuln) {
    Write-Output 'VULNERABLE: One or more WinRAR/UnRAR components are older than 7.13.'
    Write-Output 'VULNERABLE'
    exit 1
} else {
    Write-Output 'PATCHED: Detected WinRAR/UnRAR components are 7.13 or newer.'
    Write-Output 'PATCHED'
    exit 0
}